Hi, I'd like to create alert for the following scenario: in http access log, we have different return codes 2xx,3xx,4xx,5xx, etc. I'd like to get an alert when within a 10 minutes windows, the returned code 4xx for an source IP is higher than 10%. The alert will include all the source IPs that meet the percentage requirement as well as the percentage of 4xx. The alert would show sth. like the following: source ip percentage of 4xx a.b.c.d 20% x.x.x.x 13% One difficulty here is that new IPs keep showing up. Would really appreciate if anyone can help. Thanks. ... View more